@zq-silk/yui 0.15.11 → 0.16.0

package/dist/runtime/agentHost.js

@@ -1,29 +1,30 @@
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, rmSync } from "node:fs";
-import { tmpdir, homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
 import { createConnection, createServer } from "node:net";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { withSessionContextPointer } from "../context/sessionBootstrapManifest.js";
+import { publishStructuredConversationRecoverability, publishStructuredProviderAccepted, publishStructuredProviderActivity, publishStructuredProviderAttachmentExit, publishStructuredProviderConnection, publishStructuredProviderGoal, publishStructuredProviderInputObserved, publishStructuredProviderInputSettlement, publishStructuredProviderOpened, publishStructuredProviderStarted, publishStructuredProviderTerminal, structuredProviderEventDelivery } from "../controller/structuredProviderObservation.js";
 import { callController, controllerCallMayHaveApplied, ControllerClientError } from "../core/controllerClient.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
+import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
 import { isForeignHandoverLockHeld } from "../release/runtimeRelease.js";
-import { publishStructuredProviderAccepted, publishStructuredProviderAttachmentExit, publishStructuredProviderActivity, publishStructuredProviderInputSettlement, publishStructuredProviderInputObserved, publishStructuredProviderGoal, publishStructuredConversationRecoverability, publishStructuredProviderOpened, publishStructuredProviderStarted, publishStructuredProviderTerminal, publishStructuredProviderConnection, structuredProviderEventDelivery } from "../controller/structuredProviderObservation.js";
-import { validateAgentHostLaunchPayload } from "./launchBroker.js";
-import { ProviderDeliveryUnknownError, ProviderConversationMissingError, ProviderTurnBusyError, ProviderTurnRejectedError } from "./structuredProviderHost.js";
+import { yuiTmuxServerName, yuiTmuxSessionName } from "../tmux/tmuxManager.js";
+import { tmuxSocketDirectory } from "../tmux/tmuxSocketEndpoint.js";
 import { createAgentEndpointOwner } from "./agentEndpointOwnership.js";
-import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
+import { providerDeliveryFailure, providerDeliveryFailureFrom, redactAgentErrorText, serializeAgentErrorRaw } from "./agentError.js";
+import { AGENT_HOST_CONTROL_PROTOCOL, AGENT_HOST_EVENT_PROTOCOL } from "./agentHostProtocol.js";
+import { readAgentRunConfigurationObservation, unknownAgentRunConfiguration } from "./agentRunConfiguration.js";
+import { CodexPreSubmissionError } from "./codexAppServerRuntime.js";
+import { runCodexInteractiveHost } from "./codexInteractiveHost.js";
+import { validateAgentHostLaunchPayload } from "./launchBroker.js";
 import { validateRuntimeProcessExitObservation } from "./processExitObservation.js";
 import { persistRuntimeProcessExitObservation, replayRuntimeProcessExitOutbox } from "./processExitOutbox.js";
+import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
+import { ProviderConversationMissingError, ProviderDeliveryUnknownError, ProviderTurnBusyError, ProviderTurnRejectedError } from "./providerErrors.js";
 import { AGENT_HOST_CLIENT_EXIT_GRACE_MS, AGENT_HOST_CONTROL_TIMEOUT_MS, AGENT_HOST_READY_TIMEOUT_MS, ENDPOINT_DRAIN_TIMEOUT_MS, PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
-import { providerDeliveryFailure, providerDeliveryFailureFrom, redactAgentErrorText, serializeAgentErrorRaw } from "./agentError.js";
-import { runCodexInteractiveHost } from "./codexInteractiveHost.js";
-import { readAgentRunConfigurationObservation, unknownAgentRunConfiguration } from "./agentRunConfiguration.js";
 import { createSessionOwnerIdentity, readLinuxProcessIdentity } from "./sessionOwnerIdentity.js";
-import { yuiTmuxServerName, yuiTmuxSessionName } from "../tmux/tmuxManager.js";
-import { tmuxSocketDirectory } from "../tmux/tmuxSocketEndpoint.js";
-import { AGENT_HOST_CONTROL_PROTOCOL, AGENT_HOST_EVENT_PROTOCOL } from "./agentHostProtocol.js";
-import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
 export { AGENT_HOST_CONTROL_PROTOCOL } from "./agentHostProtocol.js";
 const HOST_CONTROL_MAX_BYTES = 32 * 1024;
 const CODEX_CLIENT_STABLE_MS = 5_000;
@@ -76,7 +77,7 @@ export async function runAgentHost(input) {
     if (payload.environment.YUI_SESSION_SCOPE === "global"
         && payload.environment.YUI_ADAPTER_ID === "codex"
         && payload.providerControl === undefined) {
-        return runCodexInteractiveHost(input.home, payload);
+        return runCodexInteractiveHost(input.home, payload, openAgentHostControl);
     }
     let session;
     // This process really holds the Endpoint code its Session runs on. The lease
@@ -767,13 +768,25 @@ export async function runAgentHost(input) {
             attemptId: request.run.attemptId,
             ...authorityFields()
         }));
-        const durableRun = hostRunControlParams(sessionPayload, session.nativeSessionId, request.authority, request.run.attemptId, request.runId);
+        const durableRun = { ...hostRunControlParams(sessionPayload, session.nativeSessionId, request.authority, request.run.attemptId, request.runId), boundedText: request.run.boundedText,
+            retrySupport: session.adapterId === "codex" ? "codex-failed-turn-v1" : "unsupported" };
+        let recoveryInput;
         // Registration precedes the Provider write, so its failure modes are not
         // the Provider's. A definite failure means the Provider never saw this
         // input and the occupancy must be released; anything unconfirmed leaves
         // durable state ambiguous and keeps it held.
         try {
-            await beginDurableProviderTurn(input.home, durableRun);
+            const admitted = await beginDurableProviderTurn(input.home, durableRun);
+            if (admitted !== null && typeof admitted === "object" && !Array.isArray(admitted)) {
+                const retry = admitted.retryInput;
+                if (retry !== null && typeof retry === "object" && !Array.isArray(retry)
+                    && typeof retry.text === "string")
+                    recoveryInput = {
+                        text: retry.text,
+                        ...(typeof retry.expectedFailedNativeTurnId === "string"
+                            ? { expectedFailedNativeTurnId: retry.expectedFailedNativeTurnId } : {})
+                    };
+            }
         }
         catch (error) {
             // Registration ends in one of three states and they are not
@@ -831,7 +844,11 @@ export async function runAgentHost(input) {
             // authority and Session identity before this native write.
             const receipt = endpointReceipt(await session.submit({
                 ...request.run,
-                boundedText: withSessionContextPointer(request.run.boundedText, activeRunPayload.environment),
+                boundedText: withSessionContextPointer(recoveryInput?.text ?? request.run.boundedText, activeRunPayload.environment),
+                ...(recoveryInput === undefined ? {} : { requireQuiescent: true }),
+                ...(recoveryInput?.expectedFailedNativeTurnId === undefined ? {} : {
+                    expectedFailedNativeTurnId: recoveryInput.expectedFailedNativeTurnId
+                }),
                 inputRef: request.runId ?? request.run.attemptId
             }), request.run.attemptId);
             transportAccepted = true;
@@ -1852,7 +1869,7 @@ function hostRunControlParams(payload, nativeSessionId, authority, attemptId, ru
 }
 async function beginDurableProviderTurn(home, durableRun) {
     try {
-        await callControllerIdempotently(home, "runtime.provider-turn-begin", durableRun);
+        return await callControllerIdempotently(home, "runtime.provider-turn-begin", durableRun);
     }
     catch (error) {
         if (error instanceof ControllerClientError && error.code === "SESSION_BUSY") {
@@ -1860,7 +1877,7 @@ async function beginDurableProviderTurn(home, durableRun) {
         }
         if (!(error instanceof ControllerAcknowledgementUnknownError))
             throw error;
-        await resolveProviderTurnSubmission(home, durableRun, new Error(`Provider Turn intent acknowledgement failed before Provider write: ${errorText(error)}`, { cause: error }));
+        await resolveProviderTurnSubmission(home, durableRun, new Error(`Provider Turn intent acknowledgement failed before Provider write: ${errorText(error)}`, { cause: error }), true);
         // The resolve is fenced on this exact attempt id, so its success proves
         // the registration did commit and is now settled with nothing written to
         // the Provider. That is a known outcome; reporting it as unknown would
@@ -1871,7 +1888,7 @@ async function beginDurableProviderTurn(home, durableRun) {
 }
 async function callControllerIdempotently(home, method, request) {
     try {
-        await callAgentController(home, method, request);
+        return await callAgentController(home, method, request);
     }
     catch (error) {
         if (!(error instanceof ControllerClientError)
@@ -1882,7 +1899,7 @@ async function callControllerIdempotently(home, method, request) {
         // These methods carry exact attempt, launch, and authority fences. A
         // bounded replay confirms a commit whose acknowledgement may have been lost.
         try {
-            await callAgentController(home, method, request);
+            return await callAgentController(home, method, request);
         }
         catch (replayError) {
             if (firstCallMayHaveApplied || controllerCallMayHaveApplied(replayError)) {
@@ -1903,7 +1920,7 @@ class ControllerAcknowledgementUnknownError extends Error {
 class ProviderTurnRegistrationSettledError extends Error {
     name = "ProviderTurnRegistrationSettledError";
 }
-async function resolveProviderTurnSubmission(home, durableRun, error) {
+async function resolveProviderTurnSubmission(home, durableRun, error, noProviderWrite = false) {
     const attemptId = durableRun.attemptId;
     if (typeof attemptId !== "string") {
         throw new Error("Provider Turn resolution has no attempt id.");
@@ -1915,6 +1932,7 @@ async function resolveProviderTurnSubmission(home, durableRun, error) {
             : error instanceof ProviderTurnBusyError ? "deferred" : "rejected",
         reason: errorText(error),
         raw: serializeAgentErrorRaw(error),
+        ...(noProviderWrite || error instanceof CodexPreSubmissionError ? { providerWrite: "not-issued" } : {}),
         observedAt: new Date().toISOString()
     };
     try {
@@ -1935,8 +1953,7 @@ async function resolveProviderTurnSubmission(home, durableRun, error) {
  */
 async function callAgentController(home, method, params) {
     try {
-        await callController(home, method, params);
-        return;
+        return await callController(home, method, params);
     }
     catch (error) {
         if (!isControllerUnavailable(error) || !isForeignHandoverLockHeld(home)) {
@@ -1948,7 +1965,7 @@ async function callAgentController(home, method, params) {
         await delay(50);
     // The pinned Host can rediscover a replacement, but must never start a
     // Controller using its own old implementation or open the Home's database.
-    await callController(home, method, params);
+    return await callController(home, method, params);
 }
 function isControllerUnavailable(error) {
     return error instanceof ControllerClientError

package/dist/runtime/builtinAgentErrorMappers.js

@@ -1,5 +1,8 @@
 /** Provider-specific Claude Code failure recognition. */
 export function mapClaudeAgentError(input) {
+    return withTransientEvidence(mapClaudeDisplayError(input), input);
+}
+function mapClaudeDisplayError(input) {
     const text = `${input.message}\n${input.raw}`;
     if (/^No conversation found with session ID: [A-Za-z0-9-]+\.?$/imu.test(input.message)) {
         return sessionUnavailable("provider.session-not-found");
@@ -23,6 +26,9 @@ export function mapClaudeAgentError(input) {
 }
 /** Provider-specific Codex failure recognition. */
 export function mapCodexAgentError(input) {
+    return withTransientEvidence(mapCodexDisplayError(input), input);
+}
+function mapCodexDisplayError(input) {
     const text = `${input.message}\n${input.raw}`;
     if (/^server_error$/iu.test(input.message)) {
         return recoverable("availability", "provider.server-error");
@@ -200,3 +206,88 @@ function sessionUnavailable(code) {
         sessionDisposition: "unrecoverable"
     });
 }
+/** Replay qualification is stricter than the readable, best-effort category.
+ * Never promote a number occurring in provider prose to submission safety. */
+function structuredTransientError(input) {
+    if (/insufficient[_ -]quota|quota.{0,25}(exhaust|exceed)|billing[_ -]hard[_ -]limit|usageLimitExceeded|credits?.{0,20}(exhaust|insufficient)/iu.test(`${input.message}\n${input.raw}`))
+        return { category: "access", code: "provider.quota-exhausted", retryable: false };
+    const nodes = [];
+    const visit = (value, depth) => {
+        if (depth > 8 || value === null || typeof value !== "object" || Array.isArray(value))
+            return;
+        const node = value;
+        nodes.push(node);
+        for (const key of ["cause", "error", "data", "codexErrorInfo", "responseTooManyFailedAttempts",
+            "httpConnectionFailed", "responseStreamConnectionFailed", "responseStreamDisconnected", "error_details"]) {
+            visit(node[key], depth + 1);
+        }
+    };
+    try {
+        visit(JSON.parse(input.raw), 0);
+    }
+    catch { /* Display classification may still use prose. */ }
+    const codes = nodes.flatMap(n => [n.code, n.type, n.error, n.codexErrorInfo]).filter(v => typeof v === "string");
+    if (codes.some(c => ["authentication_error", "permission_error", "invalid_api_key", "invalid_model",
+        "model_not_found", "usage_limit_exceeded", "insufficient_quota"].includes(c))) {
+        return { category: "access", code: "provider.access-denied", retryable: false };
+    }
+    const statuses = nodes.flatMap(n => [n.httpStatusCode, n.statusCode, n.status]).filter(v => typeof v === "number");
+    if (statuses.some(s => s === 401 || s === 403 || s === 400 || s === 404)) {
+        return { category: "invalid-request", code: "provider.http-4xx", retryable: false };
+    }
+    const nativeCode = input.message.trim();
+    let result;
+    if (statuses.includes(429) || codes.includes("rate_limit_error") || nativeCode === "rate_limit_error") {
+        result = recoverable("rate-limit", "provider.rate-limit");
+    }
+    else if (statuses.some(s => [500, 502, 503, 504].includes(s))
+        || codes.some(c => ["server_error", "overloaded_error"].includes(c))
+        || ["server_error", "overloaded_error"].includes(nativeCode)) {
+        result = recoverable("availability", "provider.server-error");
+    }
+    else if (codes.some(c => ["ECONNRESET", "ECONNREFUSED", "EAI_AGAIN", "ETIMEDOUT", "EPIPE"].includes(c))) {
+        result = recoverable("transport", "transport.temporary-failure");
+    }
+    if (result === undefined)
+        return undefined;
+    const waits = [];
+    for (const node of nodes) {
+        for (const value of [node.retry_after_ms, node.retryAfterMs]) {
+            if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0)
+                waits.push(value);
+        }
+        const headers = node.headers;
+        if (headers === null || typeof headers !== "object" || Array.isArray(headers))
+            continue;
+        const entries = Object.entries(headers);
+        const value = entries.find(([k]) => k.toLowerCase() === "retry-after")?.[1];
+        if (typeof value !== "string")
+            continue;
+        if (/^\d+(?:\.\d+)?$/u.test(value.trim()))
+            waits.push(Math.ceil(Number(value) * 1_000));
+        else {
+            const date = Date.parse(value);
+            if (Number.isFinite(date))
+                waits.push(Math.max(0, date - Date.now()));
+        }
+    }
+    const retryAfterMs = Math.max(...waits.filter(Number.isSafeInteger));
+    return { ...result, retryable: true,
+        ...(Number.isFinite(retryAfterMs) ? { retryAfterMs } : {}) };
+}
+/** Add positive evidence without renaming established diagnostics or letting
+ * a transient nested cause override a known fatal Session/request failure. */
+function withTransientEvidence(base, input) {
+    const evidence = structuredTransientError(input);
+    if (evidence === undefined)
+        return base;
+    const possiblyTransient = ["rate-limit", "availability", "transport", "unknown"].includes(base.category);
+    if (evidence.retryable === false)
+        return possiblyTransient ? evidence : { ...base, retryable: false };
+    if (!possiblyTransient || base.sessionDisposition === "unrecoverable")
+        return base;
+    return {
+        ...(base.category === "unknown" ? evidence : base), retryable: true,
+        ...(evidence.retryAfterMs === undefined ? {} : { retryAfterMs: evidence.retryAfterMs })
+    };
+}

package/dist/runtime/codexAppServerRuntime.js

@@ -1,4 +1,5 @@
 import { YUI_VERSION } from "../version.js";
+import { serializeAgentErrorRaw } from "./agentError.js";
 /**
  * Preserve the native non-interactive Codex identity used by our historical
  * execution adapter. A proxy's environment cannot set the daemon's originator;
@@ -94,6 +95,10 @@ export class CodexAppServerRuntime {
             conversationId: input.conversationId,
             text: input.text,
             expectedNoActiveTurn: input.expectedNoActiveTurn,
+            ...(input.requireQuiescent ? { requireQuiescent: true } : {}),
+            ...(input.expectedFailedNativeTurnId === undefined ? {} : {
+                expectedFailedNativeTurnId: input.expectedFailedNativeTurnId
+            }),
             clientUserMessageId: input.attemptId
         });
     }
@@ -101,11 +106,13 @@ export class CodexAppServerRuntime {
         const requestedThreadId = text(input.conversationId, "Codex thread id");
         let threadId = requestedThreadId;
         try {
+            const expectedFailedTurn = input.expectedFailedNativeTurnId === undefined ? undefined
+                : text(input.expectedFailedNativeTurnId, "Expected failed Codex Turn id");
             // Submission needs current availability, not historical Turns. Some
             // App Server transports expose status without supporting history reads.
             const snapshot = await this.readConversation(requestedThreadId, { includeTurns: false });
             threadId = snapshot.threadId;
-            if (input.expectedNoActiveTurn
+            if ((input.expectedNoActiveTurn || expectedFailedTurn !== undefined || input.requireQuiescent)
                 && (snapshot.status === "active" || snapshot.activeTurnId !== undefined)) {
                 return {
                     status: "busy",
@@ -115,9 +122,30 @@ export class CodexAppServerRuntime {
                         : `active-turn:${snapshot.activeTurnId}`
                 };
             }
-            if (snapshot.status !== "idle" && snapshot.status !== "active") {
+            if (snapshot.status !== "idle" && snapshot.status !== "active"
+                && !(snapshot.status === "systemError" && expectedFailedTurn !== undefined)) {
                 throw new Error(`Codex Session availability is ${snapshot.status}; no input was submitted.`);
             }
+            if (expectedFailedTurn !== undefined) {
+                // systemError alone proves neither terminal execution nor permission
+                // to replay. Only the exact latest failed Turn permits this recovery.
+                const page = await this.transport.request("thread/turns/list", {
+                    threadId, limit: 1, sortDirection: "desc", itemsView: "notLoaded"
+                });
+                const latest = object(arrayMember(page, "data")[0]);
+                if (latest?.id !== expectedFailedTurn || latest.status !== "failed") {
+                    throw new Error("Codex retry has no exact failed latest Turn proof; no input was submitted.");
+                }
+            }
+            if (expectedFailedTurn !== undefined || input.requireQuiescent) {
+                const backgrounds = await this.transport.request("thread/backgroundTerminals/list", {
+                    threadId, limit: 1
+                });
+                if (!Array.isArray(backgrounds.data) || backgrounds.data.length !== 0
+                    || backgrounds.nextCursor !== null) {
+                    throw new Error("Codex retry background execution is not proven empty; no input was submitted.");
+                }
+            }
         }
         catch (error) {
             throw new CodexPreSubmissionError("Codex Session inspection failed before input submission.", { cause: error });
@@ -304,7 +332,10 @@ function parseThreadSnapshot(result, expectedThreadId, loaded) {
                 turnId,
                 ...(status === undefined ? {} : { status }),
                 ...(output === undefined ? {} : { output }),
-                ...(error === undefined ? {} : { error })
+                ...(error === undefined ? {} : { error }),
+                ...(turn.error === undefined || turn.error === null ? {} : {
+                    rawError: serializeAgentErrorRaw(turn.error)
+                })
             }];
     });
     return {

package/dist/runtime/codexInteractiveHost.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { once } from "node:events";
 import WebSocket, { WebSocketServer } from "ws";
-import { AGENT_HOST_CONTROL_PROTOCOL, openAgentHostControl } from "./agentHost.js";
+import { AGENT_HOST_CONTROL_PROTOCOL } from "./agentHostProtocol.js";
 import { openCodexInteractiveConnection } from "./structuredProviderHost.js";
 /**
  * Keep the native TUI and its transparent App Server attachment in one pane.
@@ -13,7 +13,7 @@ import { openCodexInteractiveConnection } from "./structuredProviderHost.js";
  * until its first message. Observing the TUI's own startup avoids creating a
  * second Thread or manufacturing a bootstrap message to materialize history.
  */
-export async function runCodexInteractiveHost(home, payload) {
+export async function runCodexInteractiveHost(home, payload, openAgentHostControl) {
     const environment = payload.environment;
     if (environment.YUI_SESSION_SCOPE !== "global" || environment.YUI_ADAPTER_ID !== "codex"
         || payload.providerControl !== undefined) {

package/dist/runtime/index.js

@@ -9,7 +9,6 @@ export { promptPushOutcome, RuntimeHostContentionError, RuntimeHostUnavailableEr
 export { AgentHostPromptPushAdapter, TmuxSessionHost } from "./tmuxAdapters.js";
 export { FileTaskRuntimeIsolation, YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR, YUI_TASK_RUNTIME_SERVICE_NAMESPACE, assertTaskRuntimeIsolationPreflight, createTaskRuntimeIsolationDescriptor, parseTaskRuntimeIsolationDescriptor, planTaskRuntimeCleanup, taskRuntimeIsolationEnvironment, taskRuntimeIsolationFingerprint } from "./taskRuntimeIsolation.js";
 export { createSessionOwnerIdentity, isLinuxProcessLive, listOwnedProcessTree, readLinuxProcessIdentity } from "./sessionOwnerIdentity.js";
-export { FileSessionOwnerRegistry } from "./sessionOwnerRegistry.js";
 export { formatRuntimeLaunchDiagnostic, redactLaunchArgument, redactLaunchText, RuntimeLaunchFailure, toRuntimeLaunchFailure } from "./launchDiagnostics.js";
 export { DEFAULT_FORCED_GRACE_MS, DEFAULT_GRACEFUL_GRACE_MS, terminateSessionOwners } from "./sessionTerminationGuard.js";
 export { ProviderContinuationReconciliationService } from "./providerContinuationReconciliationService.js";

package/dist/runtime/managedCaller.js

@@ -2,6 +2,26 @@ import { activeRoleAgentBinding } from "../role/role.js";
 import { currentProviderConversation } from "./providerRuntimeIdentity.js";
 /** Native Session identity supplied by the Agent transport. */
 export const MANAGED_NATIVE_SESSION_ENV = "YUI_NATIVE_SESSION_ID";
+/** Global writes use the same command-time native identity as Task writes.
+ * A Manifest locates context; it is not continuing mutation authority. */
+export function requireManagedGlobalCaller(store, env) {
+    const name = identity(env.YUI_ROLE);
+    const role = name === undefined ? null : store.getGlobalRole(name);
+    const binding = role?.agentBindings[role.activeAgentId];
+    const set = name === undefined ? null : store.getGlobalRoleSessionSet(name);
+    const session = set?.sessions[set.activeAgentId];
+    const nativeSessionId = identity(binding?.adapterId === "codex"
+        ? env.CODEX_THREAD_ID ?? env.YUI_NATIVE_SESSION_ID : env.YUI_NATIVE_SESSION_ID);
+    if (env.YUI_SESSION_SCOPE !== "global" || env.YUI_TASK_ID !== undefined
+        || !role || !binding || !set || !session || session.status !== "active"
+        || set.activeAgentId !== role.activeAgentId || session.agentId !== binding.agentId
+        || session.adapterId !== binding.adapterId || nativeSessionId !== session.nativeSessionId
+        || (env.YUI_AGENT_ID !== undefined && env.YUI_AGENT_ID !== session.agentId)
+        || (env.YUI_ADAPTER_ID !== undefined && env.YUI_ADAPTER_ID !== session.adapterId)) {
+        throw new ManagedRuntimeDriftError("This command requires the current managed global native Session; the previous Session has no write authority.");
+    }
+    return { roleName: role.name, agentId: session.agentId, adapterId: session.adapterId, nativeSessionId };
+}
 /**
  * A managed Session presented valid self-identity but is no longer the current
  * runtime of its Task Role. This is a bounded diagnosis rather than a bare
@@ -119,7 +139,7 @@ function requireCurrentRuntime(store, self) {
         throw new ManagedRuntimeDriftError(`This managed Session carries no native session id, so it cannot be recognized `
             + `as the current runtime of ${self.taskId}/${self.roleName}.`);
     }
-    if (role.name === "leader" && store.listEvents(self.taskId).some((event) => event.type === "role.agent-bound" && event.payload.role === role.name
+    if (role.name === "leader" && store.listEventsByType(self.taskId, ["role.agent-bound"]).some((event) => event.type === "role.agent-bound" && event.payload.role === role.name
         && event.payload.revokedNativeSessionId === self.nativeSessionId)) {
         throw new ManagedRuntimeDriftError("This Leader native Session's management authority was explicitly revoked.");
     }

package/dist/runtime/providerControl.js

@@ -14,7 +14,11 @@ export class FencedProviderControl {
             conversationId: input.fence.conversationId,
             attemptId: identity(input.attemptId, "Provider input attempt id"),
             text: text(input.text, "Provider Turn input"),
-            expectedNoActiveTurn: input.expectedNoActiveTurn ?? true
+            expectedNoActiveTurn: input.expectedNoActiveTurn ?? true,
+            ...(input.requireQuiescent ? { requireQuiescent: true } : {}),
+            ...(input.expectedFailedNativeTurnId === undefined ? {} : {
+                expectedFailedNativeTurnId: identity(input.expectedFailedNativeTurnId, "Expected failed Provider Turn id")
+            })
         });
     }
     async interruptTurn(input) {

package/dist/runtime/providerErrors.js

@@ -0,0 +1,38 @@
+export class ProviderDeliveryUnknownError extends Error {
+    attemptId;
+    name = "ProviderDeliveryUnknownError";
+    constructor(message, attemptId, 
+    // Wrapping must not become the end of the causal chain: the original
+    // transport or Controller failure is the reason a reader needs.
+    options) {
+        super(message, options);
+        this.attemptId = attemptId;
+    }
+}
+export class ProviderTurnRejectedError extends Error {
+    attemptId;
+    name = "ProviderTurnRejectedError";
+    constructor(message, attemptId, options) {
+        super(message, options);
+        this.attemptId = attemptId;
+    }
+}
+/** Another ordinary client currently owns the thread's active Turn. */
+export class ProviderTurnBusyError extends Error {
+    attemptId;
+    activeTurnId;
+    name = "ProviderTurnBusyError";
+    constructor(message, attemptId, activeTurnId) {
+        super(message);
+        this.attemptId = attemptId;
+        this.activeTurnId = activeTurnId;
+    }
+}
+export class ProviderConversationMissingError extends Error {
+    conversationId;
+    name = "ProviderConversationMissingError";
+    constructor(conversationId, message) {
+        super(message);
+        this.conversationId = conversationId;
+    }
+}